Summary
A TLS configuration separation flaw in urllib3 can cause target-server verification settings to be applied to an HTTPS proxy connection. In affected proxy configurations, an attacker who can impersonate the proxy may observe or modify forwarded traffic and may receive a target TLS client certificate.
A TLS configuration separation flaw in urllib3 can cause target-server verification settings to be applied to an HTTPS proxy connection. In affected proxy configurations, an attacker who can impersonate the proxy may observe or modify forwarded traffic and may receive a target TLS client certificate.
Affected context
The issue occurs in urllib3 applications that use HTTPS proxies while configuring TLS options for the target server, particularly when forwarding HTTPS traffic or using target-specific identity and verification settings. Risk is higher when shared SSL contexts are reused and settings such as CERT_NONE can mutate the effective proxy verification policy.
The issue occurs in urllib3 applications that use HTTPS proxies while configuring TLS options for the target server, particularly when forwarding HTTPS traffic or using target-specific identity and verification settings. Risk is higher when shared SSL contexts are reused and settings such as CERT_NONE can mutate the effective proxy verification policy.
Exploit preconditions
- Attack surface: HTTPS proxy connection handling in urllib3
- Required access: The attacker must be able to intercept or impersonate the configured HTTPS proxy, typically through control of the network path or proxy endpoint
- Trigger point: Creation or reuse of an HTTPS proxy connection with target-specific TLS settings
- Why exploitation is possible: Target-server TLS options can overwrite or mutate proxy TLS verification settings, potentially causing the proxy certificate to be accepted without proper validation
- Attack surface: HTTPS proxy connection handling in urllib3
- Required access: The attacker must be able to intercept or impersonate the configured HTTPS proxy, typically through control of the network path or proxy endpoint
- Trigger point: Creation or reuse of an HTTPS proxy connection with target-specific TLS settings
- Why exploitation is possible: Target-server TLS options can overwrite or mutate proxy TLS verification settings, potentially causing the proxy certificate to be accepted without proper validation
Why this happens
The underlying bug is a failure to keep TLS configuration domains separate. Settings intended for the target server, including disabled certificate verification, can be applied to the HTTPS proxy handshake or mutate a shared proxy SSL context.
This maps primarily to CWE-295: Improper Certificate Validation, because the proxy certificate may not be validated according to the intended policy. It also relates to CWE-440: Expected Behavior Violation, since configuration reuse and forwarding behavior do not preserve the required distinction between proxy and target TLS semantics.
The underlying bug is a failure to keep TLS configuration domains separate. Settings intended for the target server, including disabled certificate verification, can be applied to the HTTPS proxy handshake or mutate a shared proxy SSL context.
This maps primarily to CWE-295: Improper Certificate Validation, because the proxy certificate may not be validated according to the intended policy. It also relates to CWE-440: Expected Behavior Violation, since configuration reuse and forwarding behavior do not preserve the required distinction between proxy and target TLS semantics.
Potential impact
- An attacker may observe forwarded HTTP or HTTPS traffic handled through the compromised proxy connection
- An attacker may modify traffic before it reaches the target service
- A target TLS client certificate may be exposed to the impersonating proxy
- Subsequent connections reusing a mutated context may continue without effective proxy certificate verification
- Confidentiality and integrity of communications through the affected proxy may be reduced
- An attacker may observe forwarded HTTP or HTTPS traffic handled through the compromised proxy connection
- An attacker may modify traffic before it reaches the target service
- A target TLS client certificate may be exposed to the impersonating proxy
- Subsequent connections reusing a mutated context may continue without effective proxy certificate verification
- Confidentiality and integrity of communications through the affected proxy may be reduced
General mitigation guidance
Mitigation generally focuses on preserving independent TLS policies for the target server and HTTPS proxy.
Common defensive patterns include:
- Keep proxy and target SSL contexts separate and immutable after construction
- Apply certificate verification settings only to the connection for which they were intended
- Avoid disabling certificate verification, especially in configurations that reuse contexts
- Use explicit proxy certificate validation and trusted certificate authorities
- Restrict access to proxy configuration and protect network paths to trusted proxy endpoints
- Avoid exposing client certificates to intermediaries unless that behavior is explicitly required
- Run applications with least privilege and minimize the sensitivity of credentials available to proxied requests
Mitigation generally focuses on preserving independent TLS policies for the target server and HTTPS proxy.
Common defensive patterns include:
- Keep proxy and target SSL contexts separate and immutable after construction
- Apply certificate verification settings only to the connection for which they were intended
- Avoid disabling certificate verification, especially in configurations that reuse contexts
- Use explicit proxy certificate validation and trusted certificate authorities
- Restrict access to proxy configuration and protect network paths to trusted proxy endpoints
- Avoid exposing client certificates to intermediaries unless that behavior is explicitly required
- Run applications with least privilege and minimize the sensitivity of credentials available to proxied requests
How teams detect issues like this
Organizations can look for this issue through:
- Static analysis of code that combines HTTPS proxy settings with target-specific TLS options
- Code review checks for shared or mutable SSL contexts used across proxy and target connections
- Tests that verify proxy certificate validation remains enabled when target verification is relaxed
- Runtime telemetry identifying unexpected proxy certificate changes or connections accepted without verification
- Policy enforcement that disallows
CERT_NONEand equivalent verification bypasses in production - Automated dependency and security review tools that flag vulnerable HTTP client behavior
Organizations can look for this issue through:
- Static analysis of code that combines HTTPS proxy settings with target-specific TLS options
- Code review checks for shared or mutable SSL contexts used across proxy and target connections
- Tests that verify proxy certificate validation remains enabled when target verification is relaxed
- Runtime telemetry identifying unexpected proxy certificate changes or connections accepted without verification
- Policy enforcement that disallows
CERT_NONEand equivalent verification bypasses in production - Automated dependency and security review tools that flag vulnerable HTTP client behavior
